
IN THE CLAIMS 



1 . (currently amended) A computer- implemented method for dynamic instrumentation 
of an executable application program using an instrumentation program, the application 
program including a plurality of original functions, each original function having an entry 
point and an endpoint, comprising: 

patching the function entry points with breakpoint instructions; 

creating a shared memory segment for the instrumentation program and the 
application program; 

upon initial invocation of the original functions in the application program and in 
response to encountering the breakpoint instructions , creating in the shared memory segment 
corresponding substitute functions including instrumentation code; and 

executing the substitute functions in lieu of the original functions in the application 
program. 

2. (canceled) 

3. (currently amended) The method of claim 1 3, further comprising replacing the break 
instruction at the entry points of the functions in the application program with branch 
instructions that target the substitute functions. 

4. (original) The method of claim 3, wherein the executable application program includes 
one or more branch instructions having target addresses that reference entry points of one or 
more of the original functions, further comprising: 

after creating a substitute function corresponding to an original function, for a branch 
instruction that references the original function replacing the target addresses to reference the 
substitute function. 

5. (original) The method of claim 1, wherein the executable application program includes 
one or more branch instructions having target addresses that reference entry points of one or 
more of the original functions, further comprising: 



2 




after creating a substitute function corresponding to an original function, for a branch 
instruction that references the original function replacing the target addresses to reference the 
substitute function. 

6. (original) The method of claim 1, further comprising: 

copying a segment of the executable application program to selected area of memory 
by the instrumentation program; 

replacing the segment of the application program with code that allocates the shared 
memory by the instrumentation program; 

executing the code in the application program that allocates the shared memory 
segment; and 

restoring the segment of the executable application from the selected area of memory 
to the application program by the instrumentation program after the shared memory is 
allocated. 

7. (original) The method of claim 6, further comprising: 

patching the function entry points with breakpoint instructions; and 

creating the substitute functions upon encountering the breakpoint instructions. 

8. (original) The method of claim 7, further comprising replacing the break instruction at 
the entry points of the functions in the application program with branch instructions that 
target the substitute functions. 

9. (original) The method of claim 8, wherein the executable application program includes 
one or more branch instructions having target addresses that reference entry points of one or 
more of the original functions, further comprising: 

after creating a substitute function corresponding to an original function, for a branch 
instruction that references the original function replacing the target addresses to reference the 
substitute function. 

10. (original) The method of claim 6, wherein the executable application program includes 
one or more branch instructions having target addresses that reference entry points of one or 
more of the original functions, further comprising: 



3 




after creating a substitute function corresponding to an original function, for a branch 
instruction that references the original function replacing the target addresses to reference the 
substitute function. 

1 1 . (original) The method of claim 6, wherein the executable application program includes a 
plurality of threads and further comprising: 

before the step of copying the segment of the executable application program 
suspending all threads of the executable application program, and selecting one of the 
suspended threads; and 

after replacing the segment of the executable application program with the code that 
allocates the shared memory, resuming execution of the one of the suspended threads at the 
code that allocates the shared memory. 

12. (original) The method of claim 11, further comprising: 

patching the function entry points with breakpoint instructions; and 

creating the substitute functions upon encountering the breakpoint instructions. 

13. (original) The method of claim 12, further comprising replacing the break instruction at 
the entry points of the functions in the application program with branch instructions that 
target the substitute functions. 

14. (original) The method of claim 13, wherein the executable application program includes 
one or more branch instructions having target addresses that reference entry points of one or 
more of the original functions, further comprising: 

after creating a substitute function corresponding to an original function, for a branch 
instruction that references the original function replacing the target addresses to reference the 
substitute function. 

15. (currently amended) An apparatus for dynamic instrumentation of an executable 

application program by an instrumentation program, the application program including a 
plurality of original functions, each original function having an entry point and an 
endpoint, comprising: 
means for patching the function entry points with breakpoint instructions; 
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0> 



means for creating a shared memory segment for the instrumentation program and the 
application program; 

means for creating in the shared memory segment corresponding substitute functions 
including instrumentation code upon initial invocation of the original functions in the 
application program and in response to encountering the breakpoint instructions ; and 

means for executing the substitute functions in lieu of the original functions in the 
application program. 

16. (new) The method of claim 3, wherein the executable application program is stored 
in memory and includes one or more branch instructions having associated target addresses 
that reference entry points of one or more of the original functions in the memory, further 
comprising: 

after creating a substitute function corresponding to an original function, for each branch 
instruction that references the original function in memory, replacing, in the application 
program stored in the memory, the associated target address with an address that references 
the substitute function. 

17. (new) The method of claim 1, wherein the executable application program is stored 
in memory and includes one or more branch instructions having associated target addresses 
that reference entry points of one or more of the original functions in the memory, further 
comprising: 

after creating a substitute function corresponding to an original function, for each branch 
instruction that references the original function in memory, replacing, in the application 
program stored in the memory, the associated target address with an address that references 
the substitute function. 
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